Traffic Mirroring Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Release

PDF

Configure buffer drop packets mirroring for ERSPAN

Updated: March 2, 2026

Want to summarize with AI?

Log in

Overview

Use this procedure to configure a global session for mirroring buffer drop packets to an ERSPAN destination.

Perform these steps on the router to configure a global session for mirroring buffer drop packets for SPAN to file destination:

Procedure

1.

Configure the tunnel mode.

Example:


Router(config)# interface tunnel-ip2
Router(config-if)# tunnel mode gre ipv4
2.

Configure the tunnel source.

Example:

Router(config-if)# tunnel source 10.10.10.10
3.

Configure the tunnel destination.

Example:


Router(config-if)# tunnel destination 192.0.2.1
Router(config-if) exit
4.

Configure a traffic mirroring session.

Example:


Router(config)# monitor-session mon2 ethernet
5.

Associate a destination interface with the traffic mirroring session.

Example:

Router(config-mon)# destination interface tunnel-ip2
6.

Configure the TM buffer drop session and save the changes.

Example:


Router(config-mon)# drops traffic-management rx 
Router(config-mon)# commit
7.

Configure a policer on the ingress interface and send the traffic at a line rate faster than the policer. The router drops the packets with the reason PACKET_GOT_DROPPED_DUE_TO_EXACT_METER (displayed as TM_EXACT_METER_DROP).

Example:

Router(config)# class-map match-any dscp1
Router(config-cmap)# match dscp ipv4 1
Router(config-cmap)# end-class-map
Router(config)# policy-map test-police-1R2C
Router(config-pmap)# class dscp1
Router(config-pmap-c)# police rate 100 mbps
Router(config-pmap-c-police)# exit
Router(config-pmap-c)# class class-default
Router(config-pmap-c)# police rate 100 mbps
Router(config-pmap-c-police)# exit
Router(config-pmap-c)# end-policy-map
Router(config)# interface HundredGigE0/0/0/0
Router(config-if)# service-policy input test-police-1R2C
Router(config-if)# commit
8.

Configure a regular SPAN to file on the ingress interface and send the traffic at 100% line rate. The router drops the packets with the reason PACKET_GOT_DROPPED_DUE_TO_STATISTICAL_METER (Displayed as: TM_STATISTICAL_METER_DROP).
9.

Verify the buffer drop packets are mirrored using the show monitor-session status command.

Example:

Router# show controllers npu stats traps-all instance all location 0/RP0/CPU0
Trap Type                                 NPU  Trap  Punt       Punt  Punt  Punt Configured Hardware   Policer Avg-Pkt Packets              Packets
                                          ID   ID    Dest       VoQ   VLAN  TC   Rate(pps)  Rate(pps)  Level   Size    Accepted             Dropped
====================================================================================================================================================================
TM_EXACT_METER_DROP                      0    256  RPLC_CPU    208   1538  0    542          523    NPU     N/A     25              18167604
TM_STATISTICAL_METER_DROP                0    257  RPLC_CPU    208   1538  0    542          523    NPU     N/A     31143           18167604  

Router# show spp node-counters location all | i SPAN
SPAN to File: 55724
SPAN drop: 31168

The Packets Accepted counter of the statistical meter dropped packets and exact meter dropped packets in show controllers npu stats traps-all should match the SPAN drop counter in show spp node-counters within an acceptable range. This is because the statistics displayed are not updated in real-time; they refresh every 30 seconds from the hardware.